Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/09/2023, 04:02

General

  • Target

    ed6a0ff29b30ba7c7af4ed5a9cf348117e4a25785166772daaf6892b6bae5984.exe

  • Size

    3.3MB

  • MD5

    c9005c1d9a58749375a27ad3682d7127

  • SHA1

    d94ac3d7199738b1e44628093a945e120392043d

  • SHA256

    ed6a0ff29b30ba7c7af4ed5a9cf348117e4a25785166772daaf6892b6bae5984

  • SHA512

    1810ccd6a673e628f8f02fbd477e1a8e03080acd6f652997cfe92f6c877b9fde6bc8f1597807d81d990865793bfea047feddabe9bd3903e1bb6b0f185c4fb540

  • SSDEEP

    98304:YROKh5VU89IrYLtWkdQZ7MVuLtInQKm0qa0V:yh5VHmrq1aZYVuAQKmwO

Malware Config

Signatures

  • Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

  • Detect Blackmoon payload 43 IoCs
  • UPX packed file 39 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Modifies Internet Explorer settings 1 TTPs 55 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ed6a0ff29b30ba7c7af4ed5a9cf348117e4a25785166772daaf6892b6bae5984.exe
    "C:\Users\Admin\AppData\Local\Temp\ed6a0ff29b30ba7c7af4ed5a9cf348117e4a25785166772daaf6892b6bae5984.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:640
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /net localgroup "Administrators" guest /add
      2⤵
        PID:1076
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" https://www.626my.com/
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4732
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4732 CREDAT:17410 /prefetch:2
          3⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:3824

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

      Filesize

      4KB

      MD5

      da597791be3b6e732f0bc8b20e38ee62

      SHA1

      1125c45d285c360542027d7554a5c442288974de

      SHA256

      5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

      SHA512

      d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7H3JZN74\suggestions[1].en-US

      Filesize

      17KB

      MD5

      5a34cb996293fde2cb7a4ac89587393a

      SHA1

      3c96c993500690d1a77873cd62bc639b3a10653f

      SHA256

      c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

      SHA512

      e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

    • memory/640-0-0x0000000000400000-0x0000000000FFA000-memory.dmp

      Filesize

      12.0MB

    • memory/640-1-0x00000000011A0000-0x00000000011A1000-memory.dmp

      Filesize

      4KB

    • memory/640-2-0x0000000000400000-0x0000000000FFA000-memory.dmp

      Filesize

      12.0MB

    • memory/640-3-0x0000000000400000-0x0000000000FFA000-memory.dmp

      Filesize

      12.0MB

    • memory/640-4-0x0000000010000000-0x00000000101A0000-memory.dmp

      Filesize

      1.6MB

    • memory/640-15-0x0000000000400000-0x0000000000FFA000-memory.dmp

      Filesize

      12.0MB

    • memory/640-26-0x00000000011A0000-0x00000000011A1000-memory.dmp

      Filesize

      4KB

    • memory/640-59-0x0000000005AE0000-0x0000000005AEF000-memory.dmp

      Filesize

      60KB

    • memory/640-63-0x0000000005AF0000-0x0000000005B01000-memory.dmp

      Filesize

      68KB

    • memory/640-67-0x0000000005AF0000-0x0000000005B01000-memory.dmp

      Filesize

      68KB

    • memory/640-68-0x0000000005AF0000-0x0000000005B01000-memory.dmp

      Filesize

      68KB

    • memory/640-69-0x0000000005B10000-0x0000000005B1F000-memory.dmp

      Filesize

      60KB

    • memory/640-73-0x0000000005B20000-0x0000000005B31000-memory.dmp

      Filesize

      68KB

    • memory/640-76-0x0000000005AF0000-0x0000000005B01000-memory.dmp

      Filesize

      68KB

    • memory/640-78-0x0000000005B20000-0x0000000005B31000-memory.dmp

      Filesize

      68KB

    • memory/640-77-0x0000000005B20000-0x0000000005B31000-memory.dmp

      Filesize

      68KB

    • memory/640-79-0x0000000005C80000-0x0000000005C8F000-memory.dmp

      Filesize

      60KB

    • memory/640-83-0x0000000005C90000-0x0000000005CA1000-memory.dmp

      Filesize

      68KB

    • memory/640-87-0x0000000005B20000-0x0000000005B31000-memory.dmp

      Filesize

      68KB

    • memory/640-89-0x0000000005C90000-0x0000000005CA1000-memory.dmp

      Filesize

      68KB

    • memory/640-86-0x0000000005C90000-0x0000000005CA1000-memory.dmp

      Filesize

      68KB

    • memory/640-92-0x0000000005B40000-0x0000000005B4F000-memory.dmp

      Filesize

      60KB

    • memory/640-96-0x0000000005B50000-0x0000000005B61000-memory.dmp

      Filesize

      68KB

    • memory/640-99-0x0000000005C90000-0x0000000005CA1000-memory.dmp

      Filesize

      68KB

    • memory/640-100-0x0000000005B50000-0x0000000005B61000-memory.dmp

      Filesize

      68KB

    • memory/640-101-0x0000000005B50000-0x0000000005B61000-memory.dmp

      Filesize

      68KB

    • memory/640-102-0x0000000005B70000-0x0000000005B7F000-memory.dmp

      Filesize

      60KB

    • memory/640-106-0x0000000005B80000-0x0000000005B91000-memory.dmp

      Filesize

      68KB

    • memory/640-110-0x0000000005B50000-0x0000000005B61000-memory.dmp

      Filesize

      68KB

    • memory/640-109-0x0000000005B80000-0x0000000005B91000-memory.dmp

      Filesize

      68KB

    • memory/640-111-0x0000000005B80000-0x0000000005B91000-memory.dmp

      Filesize

      68KB

    • memory/640-112-0x0000000001110000-0x000000000111F000-memory.dmp

      Filesize

      60KB

    • memory/640-116-0x0000000001120000-0x0000000001131000-memory.dmp

      Filesize

      68KB

    • memory/640-119-0x0000000005B80000-0x0000000005B91000-memory.dmp

      Filesize

      68KB

    • memory/640-120-0x0000000001120000-0x0000000001131000-memory.dmp

      Filesize

      68KB

    • memory/640-122-0x0000000001120000-0x0000000001131000-memory.dmp

      Filesize

      68KB

    • memory/640-130-0x0000000001180000-0x000000000118F000-memory.dmp

      Filesize

      60KB

    • memory/640-138-0x0000000001120000-0x0000000001131000-memory.dmp

      Filesize

      68KB

    • memory/640-140-0x0000000001510000-0x0000000001521000-memory.dmp

      Filesize

      68KB

    • memory/640-148-0x0000000001510000-0x0000000001521000-memory.dmp

      Filesize

      68KB

    • memory/640-151-0x0000000001540000-0x0000000001551000-memory.dmp

      Filesize

      68KB

    • memory/640-160-0x0000000001540000-0x0000000001551000-memory.dmp

      Filesize

      68KB

    • memory/640-162-0x0000000001570000-0x0000000001581000-memory.dmp

      Filesize

      68KB

    • memory/640-171-0x0000000001570000-0x0000000001581000-memory.dmp

      Filesize

      68KB

    • memory/640-172-0x0000000001150000-0x0000000001161000-memory.dmp

      Filesize

      68KB

    • memory/640-182-0x0000000001150000-0x0000000001161000-memory.dmp

      Filesize

      68KB

    • memory/640-183-0x0000000001450000-0x0000000001461000-memory.dmp

      Filesize

      68KB

    • memory/640-193-0x0000000001450000-0x0000000001461000-memory.dmp

      Filesize

      68KB

    • memory/640-195-0x0000000001420000-0x0000000001431000-memory.dmp

      Filesize

      68KB

    • memory/640-204-0x0000000001420000-0x0000000001431000-memory.dmp

      Filesize

      68KB

    • memory/640-205-0x00000000014B0000-0x00000000014C1000-memory.dmp

      Filesize

      68KB

    • memory/640-215-0x00000000014B0000-0x00000000014C1000-memory.dmp

      Filesize

      68KB

    • memory/640-216-0x00000000014E0000-0x00000000014F1000-memory.dmp

      Filesize

      68KB